Re: [gentoo-hardened] SeLinux system_u:system_r:initrc_t inside KDE

[Udo Siewert]

On Sun, 14 Aug 2011 11:25:26 +0200
Sven Vermeulen <sven.vermeulen@××××××.be> wrote:

> On Sat, Aug 13, 2011 at 8:33 PM, Mike Edenfield <kutulu@××××××.org>
> wrote:
>
> > My system-auth doesn't have anything about SELinux in it. The
> > pam_selinux.so
> > calls are in system-login. This looks like what pambase is supposed
> > to be doing. system-login.in has these:
> >
> > #if HAVE_SELINUX
> > session         required        pam_selinux.so close
> > #endif
> >
> > and system-auth.in doesn't.
> >
> > Which one should kdm/gdm be using? Right now /etc/pam.d/kde pulls in
> > system-
> > auth. Can I just move the pam_selinux calls?
> >
> >
> If you do, does it break things (like logon through terminals)?
> If not, does it fix the KDM logons?

AFAIC it doesn't break anything so far and KDM logons via xdm do have
the proper security contexts.

Regards,

Udo